What is the CVSS score of EUVD-2026-46768?

EUVD-2026-46768 has a CVSS 3.1 base score of 3.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

Oracle JDeveloper EUVD-2026-46768

| CVE-2026-60354 LOW

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-5g28-x48g-rr9m

Oracle Information Disclosure Jdeveloper

3.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

3.7 LOW

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

3.7 LOW

Network vector with no auth (PR:N) aligns with advisory; AC:H reflects non-trivial exploitation; only limited confidentiality impact with no integrity or availability effect.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:20 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Data Visualization Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle JDeveloper. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle JDeveloper accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).

AnalysisAI

Unauthorized data read in Oracle JDeveloper's Data Visualization Tools component exposes a subset of accessible application data to remote unauthenticated attackers via HTTP. Affected versions are 12.2.1.4.0 and 14.1.2.0.0, with Oracle tagging this as an authentication bypass class issue. Despite the network-accessible attack vector with no privilege requirement, the high attack complexity (AC:H) and limited confidentiality impact (C:L) anchor this at CVSS 3.7 (Low). No public exploit code exists and it is not listed in the CISA KEV catalog.

Technical ContextAI

Oracle JDeveloper is Oracle's integrated development environment for Java EE application development, part of the Fusion Middleware product family. The vulnerable component is Data Visualization Tools (DVT), a UI framework embedded in JDeveloper used to render charts, graphs, and dashboards. The vulnerability is classified under the 'Authentication Bypass' tag, suggesting the DVT component exposes an HTTP-accessible endpoint that insufficiently enforces authentication controls, allowing an unauthenticated caller to retrieve data that should require authentication. No CWE is assigned in the advisory, so the precise root cause class (e.g., improper access control, missing authentication for a critical function) is not formally confirmed. Affected CPE strings correspond to Oracle JDeveloper versions 12.2.1.4.0 and 14.1.2.0.0.

RemediationAI

Apply the patches released in Oracle's Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle does not publicly disclose exact patched build numbers outside the CPU patch set, so consult My Oracle Support for the specific patch ID applicable to your JDeveloper version (12.2.1.4.0 or 14.1.2.0.0). As a compensating control if patching is delayed, restrict network access to JDeveloper instances - particularly any HTTP listener exposed by the Data Visualization Tools component - via host-based firewall rules or network segmentation to trusted developer subnets only. Since JDeveloper is a developer IDE rather than a production server, internet-facing exposure is non-standard and its elimination alone substantially reduces the attack surface.